diff --git a/services/forgejo/default.nix b/services/forgejo/default.nix
index 8df6de6..b4de166 100644
--- a/services/forgejo/default.nix
+++ b/services/forgejo/default.nix
@@ -49,7 +49,16 @@ in
           COOKIE_NAME = "session";
         };
 
-        # TODO: SSO, disable registrations
+        service = {
+          DISABLE_REGISTRATION = true;
+          DEFAULT_KEEP_EMAIL_PRIVATE = true;
+        };
+
+        oauth2_client = {
+          REGISTER_EMAIL_CONFIRM = false;
+          ENABLE_AUTO_REGISTRATION = true;
+        };
+
         # TODO: transactional mails
         # TODO: redis cache instead of default in-memory